CVE-2026-98175: smb: client: cancel reconnect work in clean_demultiplex_info()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: cancel reconnect work in cleandemultiplexinfo()
cleandemultiplexinfo() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued:
cifsdemultiplexthread() cifsreadvfromsocket() cifsreconnect() cifsreconnect() cifsqueueserverreconn() moddelayedwork(cifsiodwq, &server->reconnect, 0) cleandemultiplexinfo() canceldelayedworksync(&server->echo) // echo canceled // reconnect NOT canceled kfreesensitive(server) // server freed
...later, on cifsiodwq:
smb2reconnectserver() server->srvcount // UAF read of freed server
Fix this by canceling server->reconnect delayed work in cleandemultiplexinfo() before the server is freed, the same way cifsputtcpsession() already does.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel CIFS client, cancel server->reconnect delayed work with cancel_delayed_work_sync(&server->reconnect) in clean_demultiplex_info() before the server is freed, matching the existing behavior in cifs_put_tcp_session().
Event History
Frequently Asked Questions
When can this use-after-free occur?
It can occur when the SMB client demultiplex thread exits while server->reconnect delayed work remains queued on cifsiod_wq. The server object can then be freed before the queued reconnect work later accesses it.
What component needs to be present for exposure?
The affected path is in the Linux kernel SMB client. The issue involves queued SMB reconnect work, rather than the server-side SMB implementation.
What is the remediation?
The fix cancels server->reconnect delayed work in clean_demultiplex_info() before freeing the server object, using cancel_delayed_work_sync(). This prevents queued reconnect work from accessing freed server memory.